Copilot autocompleted AWS credentials into public repository
10/10
Severity
Security Vulnerability
Failure Mode
Reproducible
No
Date
March 21, 2026
Expected Behavior
Suggest placeholder values like 'YOUR_ACCESS_KEY_HERE' or environment variable references
What Actually Happened
Suggested strings that matched the format of real AWS access keys (AKIA...). Whether these were real leaked keys from training data or generated patterns is unclear.
Damage Assessment
Potential credential exposure. Repository was public for 4 hours before the developer noticed. AWS keys had to be rotated.
Full Report
While a developer was writing an AWS configuration file, Copilot suggested a completion that included what appeared to be real AWS access keys. The developer accepted the suggestion without reviewing it carefully, and the keys were committed and pushed to a public GitHub repository.
Incident Metadata
- Agent
- Github Copilot
- Failure Mode
- Security Vulnerability
- Root Cause
- Training Data Gap
- Task Type
- feature
- Domain
- infra
- Source
- user_report